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We analyzed the security of the multiparty quantum secret sharing (MQSS) protocol recently 
proposed by Zhang, Li and Man [Phys. Rev. A 71, 044301 (2005)] and found that this protocol is 
secure for any other eavesdropper except for the agent Bob who prepares the quantum signals as 
he can attack the quantum communication with a Trojan horse. That is, Bob replaces the single- 
photon signal with a multi-photon one and the other agent Charlie cannot find this cheating as she 
does not measure the photons before they runs back from the boss Alice, which reveals that this 
MQSS protocol is not secure for Bob. Finally, we present a possible improvement of the MQSS 
protocol security with two single-photon measurements and six unitary operations. 

PACS numbers: 03.67.Dd, 03.67.Hk, 03.65.Ta, 89.70,+c 



In classical secret sharing the boss, say Alice di- 
vides her secret message into two pieces and sends them 
to her two agents, Bob and Charlie who are at remote 
place, respectively, for her business. Bob and Charlie 
can reconstruct the secret if and only if they collaborate. 
That is M A = M B © M c , here M A , M B and M c are the 
messages hold by Alice, Bob and Charlie, respectively. 
The advantage of secret sharing is that one of the two 
agents can keep the other one from doing any damage 
when they both appear in the process for the business. 
As classical signal is in one of the eigenstates of an op- 
erator, say a z , it can be copied freely and fully without 
leaving a track. Quantum mechanics provides some novel 
ways for message transmitting securely, such as quantum 
key distributio n 13 , Lx 14 la, lol ■ quantum secure direct com- 
munication 

[llalllia, quantum dense coding pHl^. 

and so on. 

Quantum secret sharing (QSS) is an important branch 
of quantum cryptography [2| and it is the generalization 
of classical secret sharing into quantum scenario 0, [w| . 
Since a pioneering QSS scheme was proposed by Hillery, 
Buzek and Berthiaume in 1999 by using a three-particle 
or a four-particle entangled Greenberger-Horne-Zeilinger 
(GHZ) state for sharing a classical information, called 
HBB99 customarily for short, there has been a lot of 
works focused on QSS in both theoretical [l3L IT3. ITf! ITri 
ElJllJliliailllBSIilllllllEl and experimental 
|28l l29| aspects. Almost all the existing QSS protocols 
can be attributed to the two types according to their 
goals. One is used to distribute a common key among 
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some users 




the other is used to split a secret includin g a classical one 
El El El 13 III or a quantum one [II 11 III EI E3 ■ 

Recently, Zhang, Li and Man j23| proposed a multi- 
party quantum secret sharing (MQSS) protocol for split- 
ting a classical secret message among three parties, say 
Alice, Bob and Charlie with single photons following 
some ideas from the Ref. In this paper, we will show 
that the Zhang-Li-Man MQSS protocol can be eaves- 
dropped by the agent Bob who prepares the quantum sig- 
nals with a Trojan horse attack strategy as he can steal 
almost all the information encoded by the other agent 
Charlie if he replaces the single photon with a multi- 
photon quantum signal. As Charlie does not measure 
the photons for eavesdropping check before the quantum 
signal runs back from the boss Alice, he cannot find this 
cheating, which is different in essence to the quantum se- 
cure direct communication protocol [9j and the quantum 
key distribution protocol with the practical faint laser 
pulses . Moreover, we present a possible improvement 
of the Zhang-Li-Man MQSS protocol security with two 
single-photon measurements and four unitary operations. 

Let us start with the brief description of the Zhang-Li- 
Man MQSS protocol E^. We discuss the simple case 
in which there are three parties, the Boss Alice, two 
agents, Bob and Charlie, shown in Fig.l. The princi- 
ple for other case is the same as this simple one with 
just a little modification or not. In the Zhang-Li-Man 
MQSS protocol the agent Bob prepares a batch of 
N single photons with choosing one of the two mea- 
suring bases (MBs), namely, the rectilinear basis, tr z , 
i.e., \H) = 0), \V) = |1) and the diagonal basis, a x , i.e., 
I") = tj(|0) + |1», \d) = -^(10) - |1» randomly , simi- 
lar to the Ref. 9]. Bob sends the single photons to 
Charlie, and Charlie first takes one of the three unitary 
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FIG. 1: (Color online) Schematic demonstration of the 
Zhang-Li-Man multi-party quantum secret sharing protocol 
[2^1 in the simple case. The two Charlie are the same agent 
in two different stages. 



operations /, U, H on each photon randomly and then 
sends them to Alice. Here I is the identity operation, 
U = idy — |0)(1| — |1)(0| whose nice feature is that it 
flips the state in both measuring bases 0, 0, |2^|, and 
H = -^(|0)(0| + |1)(0| + |0)(I| - |I)(I|) is the Hadamard 
operation which can realize the transformation between 
the two MBs |23f- Charlie's operations are equal to the 
encryptions on the states of the single photons. After 
receiving the single photons, Alice stores most of them 
and picks out a subset of the photons as the samples for 
eavesdropping check. For each sample, Alice requires Bob 
publish the initial state first and then Charlie tell her the 
encrypting operation, or vice versa. She performs single- 
photon measurements on the samples by choosing one of 
the two measuring bases a z and a x according to the in- 
formation published by Bob and Charlie, and analyzes 
the security of the transmission of the photons between 
Bob and Alice. If the error rate is lower than the thresh- 
old, Alice performs the identity operation / on the state 
of the single photon if she want to encode a bit 0, other- 
wise she performs the operation U on the photon. Alice 
sends the single photons to Charlie, and Charlie will read 
out the message with the help of Bob's. That is, Bob tell 
Charlie the initial states of the photons, and then gets 
the operations done by Alice. 

As pointed out in the Refs. , ^ the dishonest one 

in the agents in an MQSS cannot eavesdrop the quantum 
communication without disturbing the quantum system, 
any eavesdropper can be found out if he wants to steal the 
information. In this way, the main goal for the security 
of an MQSS is simplified to prevent the dishonest agent 
from eavesdropping the information. The Zhang-Li-Man 
MQSS protocol is secure if the eavesdropper is Charlie or 
not the two agents as the eavesdropping will disturb the 
quantum system and leave a trick in the results of the 
measurements on the sample photons before the message 
is encoded on the other photons . Moreover, the parties 
can perform a quantum privacy amplification [lOj on the 
batch of the polarized single photons for improving its 
security in a noise channel, similar to that in the Ref. 
[HE! . However the Zhang-Li-Man MQSS protocol is not 
secure if the agent Bob who prepares the quantum signal 
is the dishonest one as he can eavesdrop the information 



freely with Trojan horse attack Q even though there are 
no losses and noise in the quantum channel. We limit 
our discussion in this attack below. 

For the attack, Bob need only read out the operations 
that Charlie encodes on the photons for encrypting their 
states, and then he can get the information transmit- 
ted by the boss Alice freely. The Trojan horse attack 
can be implemented as following: (1) Bob replaces the 
single-photon quantum signal with a multi-photon quan- 
tum signal, and Charlie cannot find out this cheating 
as he does not measure the photons before they runs 
back from Alice, which is different in essence to the quan- 
tum secure direct communication protocol (2) Bob 
measures the photons with some photon number split- 
ters (PNSs: 50/50) and some detectors. As Bob has the 
information about the initial states of the photons, he 
can read out the operations done by Charlie with a large 
probability if there are several photons in each quantum 
signal. 
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FIG. 2: (Color online) The measurements with the photon 
number splitters (PNS: 50/50) in the case that there are four 
photons in each signal. 



To present the Trojan horse attack clearly, we use a 
four-photon quantum signal as the fake signal with which 
Bob eavesdrops Charlie's operations for the sake of sim- 
plicity. Bob prepares the four photons in the same state, 
say \H) = |0) and sends them to Charlie. As Charlie 
takes his operation on each signal, the four photons will 
be performed a same unitary operation and then there 
are four copies of the states encoded by Charlie with the 
same unitary operation. Bob uses three PNSs to split the 
fake signal and performs a z measurement on each photon, 
shown in Fig. 2. If Charlie takes the operation / or U, the 
outcomes of the measurements on the four photons with 
cr 2 are the same one with the probability 100%. On the 
contrast, Bob gets the same outcome with the probability 
(|) 4 = jg if Charlie operates the signal with H operation 
as Bob obtains the outcome "0" or " 1" with the probabil- 
ity 50% for each photon in the state |u) = -^(|0) + |1)). 
If Charlie performs the operations {/, 77, H} on each sig- 
nal with the same probability, the probability P e that 
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Charlie cannot determine which operation is chosen by 
Charlie on the signal is ± x (i) 4 = = 2.1%. If Bob re- 
places the single-photon signal with an N-photon signal, 
then P £ = ix (%) N . When N = 10, P e = 3.26 x 10~ 4 . 
Moreover, Bob's eavesdropping does not introduce errors 
in the results of the measurements done by Charlie in 
the final process if he just measures N — 1 photons in the 
multi-photon signal and sends the other one to Alice. 

In the Ref. @, as any eavesdropper does not know 
the initial state of the quantum signal and the parties 
take measurements on a subset of photons chosen ran- 
domly for eavesdropping check of each transmission, the 
eavesdropper cannot steal the information with a Trojan 
horse attack strategy. In the Zhang-Li-Man MQSS pro- 
tocol [2j|, there are not those two features for the agent 
Charlie. So any eavesdropper can get the operations done 
by Charlie with a Trojan horse attack strategy, including 
the agent Bob. Certainly, this eavesdropping process is 
useful just to Bob, not to other eavesdroppers as they 
will be detected by the three legitimate parties if they 
want to steal the information about the operations done 
by Alice or the initial states prepared by Bob. 

For im prov ing the security of the Zhang-Li-Man MQSS 
protocol |23], the three parties must have the capability 
to hold back an eavesdropper to attack the quantum com- 
munication with a Trojan horse. This MQSS protocol is 
secure if Charlie and Alice can forbid Bob to eavesdrop 
the quantum line. Charlie must have the ability to dis- 
tinguish whether each quantum signal is a single-photon 
one or a multi-photon one before he encrypts the signals 
with the unitary operations. For this end, Charlie can 
store the quantum signals and chooses randomly a sub- 
set of the quantum signals, similar to Alice. He splits 
the sample signals with a photon number splitter (PNS), 
similar to the Trojan horse attack done by Bob (see Fig. 
2) and then measures the two signals with the measuring 
bases a z and a x randomly. Just this modification, Char- 
lie can prevent Bob from eavesdropping without being 
detected as both the measurements will have an outcome 
if the quantum signal is a multi-photon one. Charlie uses 
the probability P m that there are many photons in each 
quantum signal sent by Bob to determine whether Bob 
is honest. If the P m is very low, Bob is a honest one. 
Certainly, Charlie can improve the security with three or 
more PNSs largely, same as that in Fig. 2. 

For the symmetry, Charlie can exploit the fourth uni- 
tary operation if = -^(|0)(0| - 11)(0| - 10)(1| - 11)(1|) for 
the encryption. That is, Charlie chooses randomly one of 
the four unitary operations {I, U, H, H} to encrypt the 
state of each photon, which will reduce the probability 
that Bob obtains the information about the operations 
done by Charlie with Trojan horse attack in particular 
in the case with a noise quantum channel. That is, the 
probability that Bob distinguishes the operations {/, U} 
from the operations {H, H} will decrease. 

For the integrity, let us describe the modified Zhang- 
Li-Man MQSS protocol as follows in brief. 

(a) The agent Bob prepares a batch of N single pho- 



tons S randomly in one of the four polarization states 
{\H), \ V), I it), \d)} randomly , similar to the Ref. He 
sends S to the agent Charlie. 

(b) After receiving S, Charlie chooses a sufficiently 
large subset of photons in S, and splits each signal with 
a PNS. He measures the two signals after the PNS with 
choosing one of the two MBs a z and a x randomly. 

(c) Charlie requires Bob to tell him the information 
about the original states of the sample photons, and he 
analyzes the probability P m that there are many photons 
in each quantum signal sent by Bob. Also he analyzes the 
error rate e r of the sample photons. 

(d) If P rn is very low and e r is lower than the thresh- 
old, Charlie encrypts almost all the remained photons in 
S with choosing randomly one of the four unitary oper- 
ations {/, U, H, H}. Also, he chooses some samples , say 
Sc from the S sequence, and performs them with one 
of the two operations {cr x ,a z } randomly, and continues 
to the next step. Otherwise he discards the results and 
repeats the quantum communication from the beginning. 

The unitary operations done by Charlie is equivalent 
to the uniform encryption on the photons. In a noise 
channel, the error correction and the privacy amplifi- 
cation techniques should be used on those photons for 
improving the security, same as those in the Ref. 0. 
The quantum error correction technique is not difficult 
in principle to be implemented, and a quantum privacy 
amplification way for the single photons was proposed 
also [lCJ. Hence, the quantum communication between 
Bob and Charlie can be made secure. 

(e) Charlie sends the remained photons, say S' to Al- 
ice. Alice stores most of the single photons and picks out 
randomly a sufficiently large subset of single photons for 
eavesdropping check. She tell Bob and Charlie the po- 
sitions of the sample photons. She requires Bob tell her 
the original states of the sample photons first, and then 
Charlie tell her the operations encoded, or vice versa. For 
the samples done by Charlie with the operations a x and 
cr z , Charlie tell Alice the positions first and then Alice re- 
quires Bob tell her their original states. Charlie publishes 
the operations for the samples Sc- 

(f) Alice measures each of the sample photons with a 
correlated MB, and determines whether there is an eaves- 
dropper monitoring the quantum line between Bob and 
Alice, see Fig.l. 

(g) If there is no eavesdropper, Alice encodes the pho- 
tons in S' except for those chosen for eavesdropping check 
(namely, S"), with the two unitary operations I and U 
which are coded as the bits and 1, respectively. Surely, 
Alice should select some photons from S" as the samples 
for eavesdropping check and operate them with I and U 
randomly, same as 0,0- Alice sends S" to Charlie. 

(h) Charlie reads out the secret message with the help 
of Bob's. That is, Bob tell Charlie the original state 
for each photon, and then Charlie measures each pho- 
ton with a correlated MB. Of course, they should check 
the eavesdropping of the transmission between Alice to 
Charlie before Bob and Charlie cooperate to read out the 
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message. 

The modified Zhang-Li-Man MQSS protocol is in 
essence equivalent to the quantum secure direct commu- 
nication protocol with quantum privacy amplification 
[To|. So it is secure. Moreover, it is not difficult to gener- 
alize this protocol to the case with N agents by modifying 
the original Zhang-Li-Man MQSS protocol [23| with the 
methods discussed above. 

In summary, we analyzed the security of the MQSS 
protocol proposed by Zhang, Li and Man |2^| and found 
that this protocol is secure for any other eavesdropper 
except for the agent Bob who prepares the quantum sig- 
nal as he can attack the quantum communication with a 
Trojan horse, i.e., he replaces the original signal with a 
multi-photon signal and measures them with some PNSs. 
Bob's eavesdropping cannot be detected. Finally, we 
present a possible improvement of the MQSS protocol se- 
curity with two single-photon measurements and six uni- 
tary operations. With those modifications, the Zhang-Li- 
Man MQSS protocol is secure not only for distributing 
a common key among the users in MQSS but also for 
splitting a secret message, same as the quantum secure 
direct communication protocol with the quantum pri- 



vacy amplification [Tol ]. 
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Addendum- For improving the security of the Zhang- 
Man-Li MQSS protocol completely, the parties of the 
communication should have the capability of prevent the 
agents from eavesdropping. The eavesdropping done by 
Charlie who does not know the original states of the 
photons prepared by Bob can be detected in the sim- 
ple way that Alice requires Charlie tell her the opera- 
tions first and then Bob publish the original states of the 
samples chosen randomly. For forbidding Bob eavesdrop, 
the best way may be that Charlie adds some decoy pho- 
tons which are prepared by Charlie and randomly in the 
states |0), |1>, |«> = ^(|0) + |1», \d) = ^=(|0) + |1», in 
the sequence S. In this way, Charlie should have an ideal 
single-photon source. 
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